A buffer overflow occurs in the Linux kernel’s per‑CPU memory allocator, specifically in pcpu_create_chunk(). When multiple page units are allocated, the function incorrectly writes beyond the intended populated bitmap because it uses the total number of pages (nr_pages) instead of the size of each unit. This out‑of‑bounds write corrupts adjacent kernel memory outside the bitmap structure. The CVE description notes that such corruption could affect kernel data structures, which may result in unstable kernel behavior. The possible downstream effects, such as system crashes or privilege escalation, are inferences drawn from the nature of the flaw and are not explicitly stated in the CVE data.

All Linux kernel releases that include the buggy percpu‑km implementation before the patch commit are impacted. The overflow was introduced by commit a63d4ac4ab609 and persisted until a later commit that both implemented pcpu_nr_empty_pop_pages and corrected the overflow. Mainstream distributions that ship a kernel version built from source prior to the inclusion of the resolving commit are therefore potentially vulnerable. Users should verify that their running kernel incorporates the identity of the patch that fixes the bitmap overflow.

The CVSS score of 7.8 indicates a high severity level, while the EPSS score of less than 1% suggests a low likelihood of exploitation as of the latest data. The vulnerability is not listed in the CISA KEV catalog. The attack vector is inferred to be local kernel execution or code that triggers per‑CPU allocations, as the overflow occurs within kernel space and the CVE description does not describe a remote exploitation path. If exploited, the memory corruption could destabilize the kernel or potentially provide privileged escalation pathways, but these outcomes are inferred from the type of flaw rather than stated in the CVE.